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(57) La presente invention execute des operations de 
controle pour les services telephoniques specialises et 
reduit l'usage frauduleux de ces services. Son domaine 
d 'application est constitue par les. divers reseaux 
telephoniques utilises pour la transmission de 
conversations, de telecopies ou de donnees. Les signaux 
sont soumis a un traitement pour determiner les 
caracteristiques du trafic du moment sur un canal et les 
interventions sont determinees par ces caracteristiques. 
Di verses concretisations de la presente invention 
peuvent etre utilisees pour empecher 1 "utilisation 
frauduleuse de services telephoniques en supprimant la 
supervision de la reponse. D'autres concretisations de 
rinvention peuvent etre utilisees pour reguler des 
services telephoniques specialises qui dependent de la 
facon dont les clients utilisent ces services. 



(57) This invention performs policing functions for 
specialized telephone services, and mitigates fraudulent 
usage of such services. It sees application ubiquitous 
telephone networks that carry voice, facsimile or voice- 
band-data traffic. Signal processing is used to determine 
the properties of traffic present on a channel at a given 
point in time, and actions are conditionally imposed 
based on said traffic properties. Embodiments of the 
invention can be applied to prevent fraudulent use of 
telephone services through suppression of the answer 
supervision response. Embodiments of the invention can 
also be applied for regulation to specialized telephone 
sen' ices which depend on the manner of customers' use 
of such services. 
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Docket no.: Sentry 2 
Access Control find Fraud Prevention Perne for Telephone Services 

Background 

This invention is intended for use in traditional telephone networks that cam' voice, facsimile or voice- 
band-data (VBD) traffic. The term "facsimile" represents Group 3 facsimile, which is a ubiquitous international 
standard for communicating facsimiles of documents over telephone networks. The term "voice-band-data" 
represents machine-generated information transported over a standard telecommunications voice channel. While 
facsimile is a form of voice-band-data, it is mentioned separately in this document to highlight the fact that it 
may be separately classified in the invention. 

There is a need for telecommunications service providers to perform policing functions for prevention 
of fraudulent use of telephone services. As noted by Else and Frantzen in US Patent 4,8 1 1,378, fraud prevention 
is an ongoing challenge for telecommunications service providers: an industry has flourished to develop methods 
and devices for evasion of billing. Many such devices rely on the fact that most of today's telecommunications 
switches open a communications channel as soon as a call is placed, even though billing does not start until the 
network establishes that the call has been answered. As a consequence, the answering party can evade billing 
by using a device that withholds the answer supervision response, which is the signal that indicates that the call 
has been answered. 

Customers with 1-800 numbers have a strong motivation to evade billing through suppression of the 
answer supervision response because they both answer the call and receive the bill. Such customers usually have 
the means to evade billing as well, as they generally operate telephone switching equipment called private-branch 
exchanges (PBXs) which can be configured to suppress the answer supervision response. 

Suitable approaches for control of answer supervision fraud are as follows: 

1 . Switches in the telephone network could be upgraded in accordance with US Patent 4,811,378 such that 
an open talk channel is only provided after the answer supervision response is observed. Such an upgrade is 
extremely expensive and time-consuming. Furthermore, one has the technical challenge of ensuring that 
customers hear each other soon as the call is answered, which is the reason that most switches were designed 
to provide an open talk channel during call setup. 

2. A device such as is described in US Patent 4,8 1 1 ,378 could be inserted into the network so as to block 
one side of the communications channel until the answer supervision response is observed. Such a device 



1 



CA 02221365 1997-11-18 



interferes in the normal functioning of the network for all calls, only a small minority of which are fraudulent. 
Means must be incorporated into the network to promptly disable the device when the call is answered, and to 
override the device when required for network maintenance and administration. Furthermore, such a device will 
block service usage by honest customers when the answer supervision response is missed because of equipment 
5 failure within the network. 

3. Intervention could be imposed when a call remains unanswered for an inordinate period of time. The 
intervention may be to terminate the call or to insert the missing answer supervision response. Unfortunately, 
the time-out period for this approach needs to be quite long because honest customers may wait a significant 
10 period of time for a call to be answered. Also, failure to produce an answer supervision response can be due to 
faults in the network equipment, and it is not desirable to disturb honest customers when such is the case. 

There is a need for telecommunications service providers to regulate access to specialized telephone services 
which depend on the manner of customers' use. Such a function is performed by a predecessor to the present 

1 5 invention, herein called the FaxCom device. (The assignee for the present invention owns the FaxCom device.) 
The FaxCom device was deployed across Canada in 1990 to support a reduced-rate facsirnilc-and-data-only 
service called FaxCom. It has also been demonstrated and sold to various international clients since 1990, and 
it has been offered as a vehicle for implementing class-based billing, where customers are billed differently based 
on whether their calls are voice, facsimile or voice-band-data. A general description of the FaxCom device was 

20 published in an article by Randall A: Law, Terrence W. Holm and Neil B. Cox entitled "Real-Time Multi- 
Channel Monitoring of Communications on a Tl Span", published in the Proceedings of the 1991 IEEE Pacific 
Rim Conference on Communications, Computers and Signal Processing at pages 306 to 309. 

The FaxCom device determines whether Voice, Facsimile or VBD are present on designated telephone calls, 
and imposes a voice message and terminates the call when voice is observed. The FaxCom device only applies 

25 policing when both sides of the channel are off-hook, which precludes its use in policing of call setup processes 
for control of answer supervision fraud. The FaxCom device does not separately classify handshaking signals 
or audible network signaling, and as a consequence it is unnecessarily slow in detecting Facsimile and VBD. 
Finally, the FaxCom device is not suitable when the direction of traffic flow is important, as it is not able 
determine which end of the communications channel is generating traffic. 

30 Other patents include components for classifying telephone signals, such as US patent 5,539,804, US 

Patent 4,809,272, US Patent 4,815,137, US Patent 4,815,136 and US Patent 4,720,862. However, none of these 
other inventions is comprised of a comparable combination of signal classification and source classification for 
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policing of specialized telephone services. 

Therefore, there is a need for a system and method to actively determine the properties of customer usage 
of telephone services, and to promptly implement prescribed actions based on the observed properties. This 
enables telecommunications service providers to perform policing functions for prevention of fraudulent use of 
5 telephone services. This also provides a means for regulating access to specialized telephone services which 
depend on the manner of customers' use. 

Summary of the Invention 



10 An object of the present invention is to allow telecommunications service providers to apply policing 

functions for telephone services on ubiquitous telephone networks that cany voice, facsimile and data traffic. 
According to the invention there is a channel state detector, a traffic classifier, a source classifier and a regulator 
device which combine to conditionally impose prescribed actions based on the observed properties of traffic on 
a communications channel 

1 5 There is provided a No- Answer-Supervision Control Platform (NASCP) which prevents unscrupulous users 

of telephone services from avoiding billing through suppression of the answer supervision response. The NASCP 
actively detects when voice, facsimile or voice-band-data is seen to emerge from a side of a communications 
channel that is apparently on-hook based on the network signaling. Prescribed actions are promptly applied when 
such illegal activity is detected. The prescribed actions may include imposition of a recorded voice message, 

20 forced call termination, forced network signaling or other actions. The NASCP is preferred over alternative 
solutions because it is rapid in detection of illegal activity, it avoids the time and expense of upgrading switches 
in the network, and it only alters the normal functioning of the network when illegal usage is detected. 

There is also provided a device to enable the offering of specialized telephone services which depend on 
the manner of customers' use. The apparatus actively determines whether the traffic on each side of a 

25 communications channel is voice, facsimile or voice-band-data, it determines which end the communications 
channel is generating the traffic, and it conditionally performs prescribed actions based on predefined rules on 
allowable traffic properties. The prescribed actions may include imposition of a recorded voice message, forced 
call termination, forced network signaling, application of specialized billing functions or other actions. The 
invention is preferred over alternative devices because it allows class-dependent actions to be imposed sooner 

30 in a call than was previously possible, it opens up new policing applications where the policing functions depend 
on which end of the call is generating the traffic, and it can be applied when only one side of the channel is off- 
hook. 
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Brief Description of the Drawings 

The novel features believed characteristic of the invention are set forth in the appended claims. The 
invention itself however, as well as other features and advantages thereof, will be best understood by reference 
5 to the description which follows, read in conjunction with the accompanying drawings wherein: 

Figure 1 is a general illustration of a representative embodiment of the invention. 

Figure 2 illustrates an embodiment of the first stage in the Traffic Classifier of Figure 1. 

10 

Figure 3 illustrates an embodiment of the second stage in the Traffic Classifier of Figure 1 . 
Figure 4 illustrates an embodiment of the first stage in the Source Classifier of Figure 1. 
1 5 Figure 5 illustrates an embodiment of the second stage in the Source Classifier of Figure 1 . 

Figure 6 summarizes network-generated signals that may occur when only one side of a channel is off-hook. 
Detailed Description with Reference to the Drawings 

20 

Referring to Figure 1 there is shown a block diagram of a representative embodiment of the invention. 
Briefly, the Channel State Detector 10 determines when to activate policing functions; the Traffic Classifier 20 
determines an overall classification of the traffic, taking into account signal classifications derived from both 
sides of the Communications Channel 4; the Source Classifier 40 determines which side of the channel is 
25 generating the traffic; and the Regulator 60 implements prescribed actions based on information from the Traffic 
Classifier 20 and the Source Classifier 40. A Network Controller 80 is included to represent the interface with 
network control entities to provide a platform for general control, management and data collection functions. The 
Network Controller 80 may be omitted in some embodiments. 

30 Channel State Detector 10 

The Channel State Detector 10 detects when the Communications Channel 4 is in a state that warrants 
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activation of policing functions. This usually amounts to enabling or disabling of policing functions depending 
on the hook-state of the channel For example, policing functions for the NASCP are activated when only one 
side of the channel is off-hook, and policing functions for a facsimile-and-data-only service such as FaxCom are 
activated when both sides of the channel are off-hook. The hook-state of the channel may be determined from 

5 signaling information within the Communications Channel 4 (dashed lines 7), or from a separate signaling 
source (dotted line 9), depending on the signaling conventions used in the telephone network. In particular, 
dashed lines 7 are used for networks operated in accordance with what is commonly called Channel Associated 
Signaling (CAS) protocols, and dotted line 9 is used for networks operating in accordance with what is 
commonly called Common Channel Signaling (CCS) protocols. The output 19 of the Channel State Detector 

10 10 is an enable/disable signal used for activating or deactivating policing functions in other parts of the 
invention. 

Traffic Clas$ifier 20 

15 The Traffic Classifier 20 produces an output Traffic Class 39 which characterizes the traffic on the 

Communications Channel 4 at any given point in time. This is typically a two-stage process, where the first stage 
involves derivation of two signal classifications, one for each side of the communications channel, and the 
second stage involves generation of the output traffic class 39 based on the time course of the two signal 
classifications, 

20 Referring to Figure 2 there is a block diagram of an embodiment of the first stage of the Traffic Classifier 

20. The input 21 is the signal from one side of the Communications Channel 4. The output Signal Class 33 is 
an indication of the type of signal on input 21. An identical apparatus is applied for each side of the channel. The 
Line Length Compensator 22 is a slowly-adapted filter used to compensate for the high-frequency attenuation 
caused by long communication lines. The compensated signal 23 is passed to the Spectrum Classifier 24 for 

25 estimating the most likely signal class based solely on the local spectral characteristics. The Spectrum Classifier 
24 ma>' also output spectral analysis information 25 for use in adaptation of the Line Length Compensator 22. 
The Handshaking Detector 26 and the Tone Detector 28 specifically detect a number of standard facsimile and 
VBD handshaking signals. The Audible Network Signaling Detector 30 specifically detects audible network 
signaling such as dial tone and busy signal. Finally, the Signal Classifier 32 determines the output Signal Class 

30 33 based on information gathered from the time course of the outputs of the Spectrum Classifier 24 and the three 
detectors (26, 28, 30). 

The set of signal classes output from Figure 2 depends on the application. This set typically includes zero 
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or more classes from each of the following general categories: Voice, Facsimile, VBD, Audible Network 
Signaling, Facsimile Handshaking, VBD Handshaking, Silence, and Unknown. 

Referring to Figure 3 there is a block diagram of an embodiment of the second stage of the Traffic Classifier 
20. The inputs 33A and 33B are signal classifications, one from each side of the Communications Channel 4, 
such as are derived in the first stage of the Traffic Classifier 20. The input signal classifications are mapped onto 
a set of intermediate classes 35A and 35B, which are then used in combination with the current Traffic Class 
37 to update the output Traffic Class 39. 

The set of intermediate classes conveyed over lines 35A and 35B of Figure 3, and the set of traffic classes 
output on line 39 of Figure 3, depend on what is required in the Regulator 60 to meet the needs of the 
application. These sets typically includes zero or more classes from each of the following general categories: 
Voice, Facsimile, VBD, Audible Network Signaling, Facsimile Handshaking, VBD Handshaking, Silence, and 
Unknown. 

In order to configure the Traffic Classifier 20 for a particular application, it is necessary to define tables for 
mapping of signal classes onto intermediate classes as well as a table for updating the output Traffic Class 39 
based on the Intermediate Classes 35A and 35B and preceding values of the Traffic Class 37. Certain 
applications also require that the signal class mapping process be dynamically altered when certain signal classes 
are observed. This provides a mechanism for allowing handshaking early in the call to influence traffic 
classifications throughout the remainder of the call. 

Source Classifier 40 

The Source Classifier 40 produces an output source class 59 that indicates which end of the 
Communications Channel 4 is generating traffic at any given point in time. One can not assume that signals on 
a given side of a communications channel were generated on that side, as cross-talk and echoes can cause 
significant leakage from one side to another. Source classification is typically a two-stage process, where the first 
stage involves derivation of two amplitude estimates, one for each side of a communications channel, and the 
second stage involves generation of the output source class 59 based on the two amplitude estimates. 

Refenring to Figure 4 there is a block diagram of an embodiment of the first stage of the Source Classifier 
40. The input 41 is the signal from one side of the Communications Channel 4. The output Amplitude Estimate 
53 is an estimate of the average amplitude on one side of the Communications Channel 4. An identical apparatus 
is applied for each side of the channel. The Block Segmenter 42 and the Block Amplitude Estimator 44 combine 
to periodically produce Block Amplitude Estimates 45, which are estimates of the average amplitude of the signal 
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for successive blocks of signal samples. The average of the square of all samples in a block is a suitable formula 
for estimating a block's amplitude. The remaining components of Figure 4 define a specialized averaging process 
which rapidly increases the output Amplitude Estimate 53 when it is less than the Block Amplitude 45, and 
slowly decreases the output Amplitude Estimate 53 when it is higher than the Block Amplitude 45. The 
5 Multiplier 48 determines the rate of decline of the output Amplitude Estimate 53 when the Block Amplitude 45 
drops. 

Referring to Figure 5 there is a block diagram of an embodiment of the second stage of the Source Classifier 
40. The inputs 53 A and 53B are amplitude estimates, one from each side of the Communications Channel 4 ; 
such as are derived in the first stage of the Source Classifier 40. The output Source Class 59 indicates which side 
10 of the Communications Channel 4 is generating the traffic. The result is based on the notion that the signal 
originates from the side of the channel that has the largest estimated amplitude. 

Regulator 60 

15 The Regulator 60 causes conditional imposition of prescribed actions based on the Traffic Class 39 and the 

Source Class 59. It is configured to impose the prescribed actions when specified combinations of traffic classes 
and source classes occur, or when different specified combinations of traffic classes and source classes fail to 
occur within a specified period of time. These specified combinations may change over the course of policing 
as a consequence of the passage of time or the observance of specific combinations of traffic classes and source 

20 classes. The prescribed actions may comprise of altering the signal on the Communications Channel 4 (dashed 
lines 67), or sending of requests for prescribed actions to separate devices within the network (dotted line 69). 
The prescribed action may be to impose a recorded voice message, to terminate the call, to apply special billing 
functions, or other actions. 

The Regulator 60 is typically implemented by mapping the Traffic Class 39 and Source Class 59 onto a set 

25 of generic categories such as "Good", "Maybe", "Bad" and "Silence", as well as two special categories called 
"Ignore" and "Freeze". Intervention does not occur when "Good" traffic is observed, but it is imposed when 
"Bad" traffic is observed. The "Maybe" category is equivalent to either "Good" or "Bad", depending on the 
configuration. The "Silence" category may or may not elicit intervention, depending on the requirements of the 
application. 

30 The "Ignore" category and the "Freeze" category serve special functions in the Regulator 60. When a traffic 

class is mapped onto "Ignore", it has no effect on the actions of the Regulator 60. When a traffic class is mapped 
onto "Freeze", the Regulator 60 is disabled until a different traffic class is observed. In particular, actions that 
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would normally occur when certain timers expire are deferred until the system is released from its frozen state. 

Certain applications require refinements to the Regulator 60, such as inclusion of timers that are started (or 
stopped) when the Traffic Class 39 or Source Class 59 changes. This allows prescribed actions to be triggered 
when a given traffic class remains unaltered for a specified period of time. Other timers may be included for 
triggering of prescribed actions a specified period of time after the call starts. Other applications may require 
maintenance of running tallies of the time spent in each traffic class (and source class), or records of the 
sequence of observed traffic classes (and source classes). 

It is generally desirable to provide mechanisms for partially disabling the Regulator 60. For example, the 
prescribed actions of the Regulator 60 can be disabled so that tests of policing functions can be performed 
without disturbing customers. The Regulator 60 is then operative for collection of data on the degree to which 
said prescribed actions would be imposed if they were active. 

A preferred embodiment of the Regulator 60 operates as follows. An initial period of grace is allowed at 
the start of a call during which all traffic is acceptable, i.e., prescribed actions are never imposed during the grace 
period After the grace period expires, the only acceptable class of traffic is facsimile, with all other traffic classes 
leading to imposition of a voice message and forced call temiination. An alternative preferred embodiment 
operates to impose a voice message and terminate the call whenever voice is observed after the grace period. 
These preferred embodiments see application in policing of a "facsimile-only" telephone service and an 
"anything-but-voice" telephone service, respectively. Note that the grace period is an important element of the 
Regulator 60, because legitimate facsimile calls may be set up manually. 

Network Controller 80 

The Network Controller 80 represents the interface with control entities of the telephone network to provide 
control, management and data collection functions. Configuration control, reporting of alarms, detection of 
failures and execution of periodic system integrity checks are coordinated by the Network Controller 80. Periodic 
reports about the properties of traffic on the communications channel, and about the policing activities of the 
invention, are gathered by the Network Controller 80 and saved for future inspection. Such periodic reports are 
a direct outgrowth of the need for periodic system integrity checks, whereby the Network Controller 80 monitors 
the invention to ensure that policing functions are being applied appropriately. Finally, the Network Controller 
80 may supply signaling information or implement policing actions when performance of such functions are not 
limited to operations performed on the Communications Channel 4. 
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An Embodiment for Answer Supervision Fraud Control 

The embodiment of the invention dedicated to control of answer supervision fraud is called the no-answer- 
supervision control platform (NASCP). Referring to the block diagram in Figure 1, the various components of 
the NASCP perform the following functions: 

1. The Channel State Detector 10 activates policing when only one side of a channel is off-hook, and 
deactivates policing at other times. 

2. The Traffic Classifier 20 determines whether or not the channel is carrying signals generated by customers. 
The processing is consistent with Figure 2 and Figure 3, and descriptions thereof. Further details are provided 
in the sequel. 

3. The Source Classifier 40 determines which side of the channel is generating the traffic. This is important 
in the NASCP because customer-generated traffic frequently appears on the off-hook side of a channel before 
a call is answered. For example, a person may talk to someone else while they are waiting for a call to be 
answered The processing is consistent with Figure 4 and Figure 5, and descriptions thereof The multiplier 48 
in Figure 4 is set such that the Amplitude Estimates 53 are averaged over a number of seconds. This ensures that 
the derived Source Class 59 does not change during relatively short silent periods such as are encountered in the 
"telephone ringing" signal, during silent periods in a voice conversation, or during page breaks within facsimile 
transmissions. 

4. The Regulator 60 waits for a configurable "grace period" after being enabled by the Channel State Detector 
10, and then acts to force both sides of the channel to an off-hook state when significant amounts of customer- 
generated traffic arc observed emerging from the side of the channel that is apparently on-hook. The Regulator 
60 also forces both sides of the channel to an ofT-hook state when the channel has been in a one-side-off-hook 
state for an inordinate period of time. The act of forcing both sides of the channel to an off-hook state causes 
switches in the network to initiate billing. For networks operated in accordance with what is commonly called 
channel associated signaling (CAS) protocols, the hook-state forcing functions arc implemented by altering 
signaling information carried within the communications channel, i.e., dashed lines 67 in Figure 1 . For networks 
operating in accordance with what is commonly called Common Channel Signaling (CCS) protocols, the hook- 
state forcing functions are implemented by triggering the generation of signaling messages over a separate 
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signaling network, i.e., dotted line 69 in Figure 1 . Other functions, such as imposition of a voice message or call 
termination, can also be performed by the Regulator 60 if needed by the network service provider. 

Referring to Figure 6 there is an overview of network-generated signals that can occur at various points in 
a telephone network when only one side of a channel is off-hook. The Traffic Classifier 20 in the NASCP needs 
to specifically detect only a subset of these signals, as some of them only appear at certain points in the network, 
while others only appear under circumstances that arise when both sides are off-hook. The following comments 
apply: 

1. SS4 and SS5 Signaling Tones: In older network equipment, many call administration functions are 
performed by passing high-frequency tone pulses. Single-component and double-component tone pulses with 
component frequencies of 2040 Hz, 2400 Hz and/ or 2600 Hz are used. These signals do not appear where a 
NASCP is logically located in today's networks. 

2. Low Frequency Audible Signaling Tones: A wide variety of audible signaling tones are. defined to provide 
customers with feedback on the status of their call. Standards suggest a "precise tone plan" for such signals, 
where all signaling tones are defined as one-component or two-component signals whose component frequencies 
are 350 Hz, 440 Hz, 480 Hz or 620 Hz. While the precise tone plan is not universally adhered to, it is fair to say 
that Low Frequency Audible Signaling tones are comprised of either one or two sinusoidal components, each 
with a frequency lower than about 620 Hz. A number of these tones, such as the Dial Tone, the Ringing Tone 
or the Busy Tone, are common for relatively long periods of time during a one-side-off-hook condition. Hence, 
the NASCP must separately classify such signals. 

3. Recording Warning Tone (RWT): The RWT is used to inform customers that a conversation is being 
recorded. The NASCP does not need to detect RWT because, if a conversation is in progress, the call will have 
advanced to a state where both sides are off-hook. 

4. Payphone Recognition Tone (PRT): The PRT is used to identify a called phone as a payphone so that 
operators can prevent fraud on collect calls. The PRT is normally generated immediately after the called party 
answers the call and as such is not a concern for the NASCP. The PRT can also be used to identify when a caller 
is a payphone, in which case it may appear during the one-side off-hook interval. However, many administrations 
do not use the PRT in this manner, and when it is used it will appear to emerge from an off-hook source from 
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the point of view of theNASCP. Therefore, the NASCP does not need to actively detect the PRT. 

5. Coin Deposit Tone (CDT): The CDT is a combination of 1700 Hz and 2200 Hz at (nominally) the same 
amplitude. Separate classification of CDT by the NASCP is not necessary, as people do not need to deposit coins 

5 when calling 1-800 numbers, which is the main area where answer supervision fraud occurs. 

6. Special Information Tone (SIT); The SIT is used to inform a caller of unusual reasons for call failure. The 
SIT is usually followed by a short recorded voice message.The NASCP must accept SIT, and voice messages 
after SIT, as being valid network-generated signals. This allows for network-generated voice messages to be 

10 inserted in accordance with common practice. 

7. Receiver Off-Hook (ROH) Howler Signal; ROH is generated when one of the participants in a call fails to 
hang up, Since in this circumstance the call has already been completed, the NASCP need not separately classify 
the ROH signal. ROH can also be generated when a customer lifts up the handset but fails to dial. In this case 

1 5 the "call" is unlikely to ever pass through the NASCP. The conclusion is that the NASCP does not need to take 
special measures to detect the ROH signal 

8. Multi-Frequency Signaling (MF): When channel associated signalling is employed, MF tones are used 
within the network for communicating called numbers and calling numbers. Such tones occur in a relatively short 

20 burst near the start of a call. The NASCP can thus ignore MF by simply delaying the activation of policing by 
a few seconds. 

9. Dual Tone Multi-Frequency (DTMF) for Dialing: DTMF does not normally occur for call setup within the 
network. However, such signals may occur if the NASCP is located between the PBX and the network. Like MF, 

25 one can assume that network-generated DTMF occurs in a short burst near the start of the call. 

10. Other DTMF; DTMF generated by the customer after the number is dialed should be lumped with Voice 
and VBD as illegal activity when only one side is off hook. That is, the NASCP should treat such DTMF as if 
it were Voice or VBD. 

30 

By the discussion presented here, the Traffic Classifier 20 in the NASCP needs to actively detect the low- 
frequency audible signaling tones, the special information tone, and a short voice message after the special 
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information tone. Other network signals may also need to be detected, depending on the practices of the 
telecommunications service provider. 

By interpreting voice after SIT as a network-generated signal, a means has in principle been created for 
defeating the NASCP by repeated insertion of SIT into the call. However, such action would require complicity 
of both parties in accepting periodic insertion of SIT. Callers of 1 -800 numbers are not likely to find this 
acceptable. Owners of 1-800 numbers will also not be eager to explain to customers that they are inserting the 
SIT for the purpose of fraud. Nonetheless, network administrators may prefer to disable this feature of the 
NASCP, or to introduce additional constraints on the allowable frequency and duration of SIT messages passing 
through the NASCP. 

While this invention has been described with reference to illustrative embodiments, this description is not 
intended to be construed in a limiting sense. Various other embodiments of the invention will be apparent to 
persons skilled in the art upon reference to this description. It is therefore contemplated that the appended claims 
will cover any such modifications of embodiments as fall within the true scope of the invention. 
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Docket no.: Sentry2 

I claim: 

1. An apparatus for performing policing functions for telephone services in a telephone network, wherein 
prescribed actions are conditionally imposed based on the properties of traffic on a communications channel 
comprising: 

(a) a channel state detector coupled to said communications channel and operative to enable and disable 
the policing functions; 

(b) a traffic classifier coupled to said communications channel operative to classify traffic on said 
communications channel into a traffic class; 

(c) a source classifier coupled to said communications channel operative to generate a source class based 
on a determination of which end of the communications channel is the dominant source of traffic; and 

(d) a regulator device coupled to said traffic and source classifiers and to said communications channel and 
operative to initiate conditional imposition of prescribed actions, the conditional imposition being based on the 
traffic class and the source class. 

2. An apparatus according to Claim 1 wherein said communications channel is a ubiquitous channel for 
carrying voice, facsimile or voice-band-data traffic. 

3. An apparatus according to Claim 1, wherein said channel state detector includes an enabling and disabling 
device operative to enable and disable policing based on an apparent on-hook and off-hook state of each end of 
said communications channel, the apparent on-hook and off-hook state being determined by signals received 
from the telephone network. 

4. An apparatus according to Claim 1 wherein said traffic classifier comprises a first stage which classifies 
the signal on each side of said communications channel to provide derived signal classifications, and a second 
stage having respective inputs thereto coupled to outputs from said first stage and providing an output traffic 
class based on the derived signal classifications for each side of said communications channel. 
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5. An apparatus according to Claim 4 wherein said first stage has two identical signal classification devices, 
one coupled to each side of said communications channel, each of said signal classification devices comprising: 

(a) a line length compensator coupled to a corresponding side of said communications channel and 
5 operative to derive a compensated signal which compensates for high-frequency attenuation caused by the 

effects of long telephone lines; 

(b) a spectrum classifier coupled to said line length compensator operative to analyze the spectral 
characteristics and determine the likely signal classification of the compensated signal; 

10 

(c) a handshaking detector coupled to said line length compensator operative to detect handshaking signals 
of telephone network traffic; 

(d) a tone detector coupled to said line length compensator operative to detect tones of telephone network 
15 traffic; and 

(e) a signal classifier coupled to said spectrum classifier, said handshaking detector and said tone detector 
and operative to derive an output signal class. 

20 6. An apparatus according to Claim 5, additionally comprising an audible signaling detector having an input 
coupled to an output of said line length compensator and an output coupled to said signaling classifier, said 
audible signaling detector operative to supply said signal classifier with indications of the presence of audible 
network signaling on the compensated signal, where the indications are considered in the signal classifier in 
deriving the output signal class. 

25 

7. An apparatus according to Claim 4 wherein said second stage is comprised of: 

(a) a pair of signal class mappers coupled to respective outputs of said signal classifiers and operative to 
derive a pair of intermediate classifications; and 

30 

(b) a traffic class determiner coupled to an output of each of said signal class mappers and operative to 
determine an output traffic class based on the intermediate classifications and prior samples of the output traffic 
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class. 

8. An apparatus according to Claim 7 wherein said signal class mappers are modified in response to the 
presence of predetermined signal classes. 

5 

9. An apparatus according to Claim 4 wherein said derived signal classifications and said output traffic class 
each include classes selected from a group consisting of Voice, Facsimile, Voice-Band-Data, Audible Network 
Signaling, Facsimile Handshaking, Voice-Band-Data Handshaking, Silence and Unknown. 

10 10. An apparatus according to Claim 1 wherein said source classifier comprises a first stage which derives an 
amplitude estimate for each side of said communications channel, and a second stage having respective inputs 
thereto coupled to outputs from said first stage and providing an output source class based upon the derived 
amplitude estimates for each side of said communications channel. 

15 1 1. An apparatus according to Claim 10 wherein said first stage is comprised of two identical amplitude 
estimation devices coupled to respective sides of said communications channel, each amplitude estimation device 
comprising: 

(a) a block segmenter coupled to one side of said communications channel operative to isolate blocks of 
20 signal samples; 

(b) a block amplitude estimator coupled to an output of said block segmenter operative to produce periodic 
estimates of the amplitude of the signal for successive blocks of signal samples; and 

25 (c) an averager coupled to an output of said block amplitude estimator operative to produce an output 

amplitude estimate for signals on said one side of said communications channel. 

12. An apparatus according to Claim 1 1 wherein the output of said block amplitude estimator is based on the 
average of the square of signal samples within a block. 

30 

13. An apparatus according to Claim 1 1 wherein said averager acts to rapidly increase the output amplitude 
estimate when its current value is lower than the output of the block amplitude estimator, and to slowly decrease 
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the output amplitude estimate when its current value is higher than the output of the block amplitude estimator. 

14. An apparatus according to Claim 10 wherein the output source class of said second stage is based on 
identification of the largest of the two amplitude estimates output from said first stage. 

5 

15. An apparatus according to Claim 1 wherein said regulator device imposes prescribed actions on said 
communications channel when specified combinations of traffic classes and source classes occur, and when 
different specified combinations of traffic classes and source classes fail to occur within a specified period of 
time. 

10 

1 6. An apparatus according to Claim 15 wherein said specified combinations are modified during the course 
of policing on said communications channel, said modification being a consequence of the passage of time and 
the observance of specific combinations of traffic classes and source classes. 

15 17. An apparatus according to Claim 15 wherein the prescribed actions of said regulator device include 
imposition of a voice message on said communications channel. 

18. An apparatus according to Claim 1 5 wherein said prescribed actions include a forcing of both sides of said 
communications channel to an on-hook state, therebyxausing calls and call setup attempts to be terminated by 

20 switches in the telephone network. 

19. An apparatus according to Claim 15 wherein said prescribed actions include a forcing of both sides of said 
communications channel to an off-hook state, thereby ensuring that switches within the telephone network 
receive an answer supervision response. 

25 

20. An apparatus according to Claim 1 wherein said channel state detector and said regulator device are each 
couplable with controlling devices of the telephone network to obtain control, management and data collection 
functions. 

30 21. An apparatus according to Claim 20 wherein said controlling devices coordinate system configuration, 
reporting of alarms, detection of system failures, execution of periodic system integrity checks, and the gathering 
and storage of reports on the policing functions. 
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22. An apparatus according to Claim 20 wherein said controlling devices supply signaling information to said 
channel state detector when such signaling information is not available from said communications channel 

23. An apparatus according to Claim 20 wherein said controlling devices coordinate the performance of said 
5 prescribed actions when such actions are not limited to manipulation of the signal on said communications 

channel. 

24. An apparatus according to Claim 1 wherein said policing functions comprise voice message imposition and 
call termination when: 

10 

(a) network signaling indicates that both sides of said communications channel are in an off-hook state; 

(b) a specified period of grace has elapsed since both sides of the communications channel went off-hook; 
and 

15 

(c) the properties of traffic observed on the channel are not consistent with the predetermined set of traffic 
properties that the network service provider wishes to allow on said communications channel. 

25. An apparatus according to Claim 1 wherein said policing Sanctions comprise a forcing of both sides of the 
20 communications channel to an off-hook state when: 

(a) network signaling indicates that only one side of said communications channel is in an off-hook state; 

(b) a specified period of grace has elapsed since entering a state where only one side of the communications 
25 channel is off-hook; 

(c) the source class indicates that the traffic is emerging from the side of the communications channel that 
is apparently on-hook; and 

30 (d) the traffic class for the side of the communications channel that is apparently on-hook is not consistent 

with traffic generated by the network service provider. 
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26. An apparatus according to Claim 1 wherein said policing functions include unconditional imposition of said 
prescribed actions in a specified period of time after the onset of policing. 

27. An apparatus according to Claim 1 wherein said prescribed actions are disabled, thereby making it operative 
5 for collection of data on the degree to which said prescribed actions would be imposed if they were activated. 

28. A method of policing a telephone network having network controlling devices and a communications 
channel so as to conditionally impose prescribed actions on the communications channel based upon the 
properties of traffic thereon, comprising: 

10 

(a) classifying the traffic into a traffic class; 

(b) determining which end of the communications channel is the dominant source of traffic; and 

15 (c) imposing conditional prescribed actions based upon the traffic class and the determination of the 

communications channel end which is the dominant source of traffic. 

29. A method according to Claim 28, additionally comprising enabling and disabling of policing in response 
to signals corresponding to apparent on-hook and off-hook states of each end of said communications channel. 

20 

30. A method according to Claim 28, additionally comprising classifying a signal on each side of said 
communications channel to provide derived signal classifications and generating an output traffic class based 
upon the derived signal classifications. 

25 3 1 . A method according to Claim 28, wherein said classifying step includes: 

(a) deriving a compensated signal which compensates for the effects of long telephone lines; 

(b) analyzing the spectral characteristics and determining the likely signal classification of the compensated 
30 signal; 

(c) detecting tones and handshaking signals of telephone network traffic; and 
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5 



(d) deriving an output signal class based on the results of steps (a), (b) 7 and (c). 

32. A method according to Claim 28, wherein said communications channel is a ubiquitous one for earn ing 
voice, facsimile and voice-band-data traffic. 



David S. Wainwright 
1 0 Patent agent for the applicant 
Reg. No. 4267 
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Docket no.: Sentry2 

Abstract 

This invention performs policing functions for specialized telephone services, and mitigates fraudulent usage 
of such services. It sees application in ubiquitous telephone networks that carry voice, facsimile or voice-band- 
5 data traffic. Signal processing is used to determine the properties of traffic present on a channel at a given point 
in time, and actions are conditionally imposed based on said traffic properties. Embodiments of the invention 
can be applied to prevent fraudulent use of telephone services through suppression of the answer supervision 
response. Embodiments of the invention can also be applied for regulation of access to specialized telephone 
services which depend on the manner of customers' use of such services. 
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Figure 1 General Illustration of the Invention 
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Figure 2 Traffic Classifier Stage 1 of 2 
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Figure 3 Traffic Classifier Stage 2 of 2 
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Figure 4 Source Classifier Stage 1 of 2 
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Figure 5 Source Classifier Stage 2 of 2 
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Figure 6 Summary of Network-Generated Signals 



Name 


Properties 


SS4: ITU Q.122 


2040 Hz, 2400 Hz or both, f ± 6 Hz, >30 ms duration, >30 ms spacing 




SS5:ITUQ.141 


2400 Hz, 2600 Hz or both, f ± 15 Hz, >30 ms duration, >30 ms spacing 




AUDIBLE TONES: Bellcore TR-NWT-000506, ITU Q.35 








Dial Tone 




340-425 Hz + 4CXM50 Hz, diff>25 Hz, or single tone 400^450 Hz 








steady on, or 0.1 si 


X on, 0. 1 sec off three times, or both 






Call Interrupt 




440 Hz, 2 sec burst 








Call Waiting 




400-450 Hz, 0.3-0.5 sec on, 8-10 sec spacing or two or three repetitions of 0.1-0.2 sec on, 






0.1 -0.2 sec off 










High Tone 




480 Hz, 0.5 sec on, or steady on 








ZIP Tone 




480 Hz, 0.1 sec on, 0.1 sec off, 0.1 sec on, or one burst of 0.75-1 sec 




Ringing 




340-500 Hz possibly modulated @ 16-100 Hz, 0.67-2.5 sec on, 3-5 sec off, repeating 


Busy Tone 




340-500 Hz (425 preferred), equal on/off, 0.3-1.1 sec cycle time 




Low Tone 




480 Hz + 620 Hz, 0.25-.5 sec on, same time off, repeating, or 0.5-1 sec once 


Special Info Tone 




950 Hz, 1400 Hz, 1800 Hz in succession, each 330±70 ms with <30 ms gap, f±50 Hz 


Recording Warning 




L4400:Hz±li5% i :fo] 


r 350-500 ms 








Payphone Recognition 




fl=l 100-1750, f2=750-1450, fl/f2=1.2-1.5, fl on 200 ms off 200 ms, 17 on 200 ms off 2 sec 


Coin Deposit Tones 




Dual-Tone 1700+2200 ± 3.5%, ± 5dB twist, >-25dBmO, 20-700 ms, >20 ms spacing 


Rx Off Hook (Howler) 


1400 Hz + 2060 Hz + 2450 Hz + 2600m Hz, 0.1 sec on, 0.1 sec off, repeating. 


DTMF: ITU Q.23, Q.24: >40 ms duration, >30 ms spacing, f ± 2%, +6 dB to -10 dB twist (on UNI but not NNI) 
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MF: ITU Q.153, Q322: >55 ms duration, >55 ms spacing, f ± 1.5%, ± 6 dB twist 
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